Mortal Online data breach: what happened and what to do

In June 2018, the MMORPG Mortal Online was breached. About 607,000 accounts leaked with email addresses, names, usernames, physical addresses and MD5 password hashes. If you had an account, change that password anywhere you reused it.

View all 13,177 breaches

Breach date: 17 Jun 2018
Affected: 606,637
Data exposed: Email addresses, Names, Passwords, Physical addresses, Usernames
Verified: Yes
Last updated: 27 Oct 2026

Source: Have I Been Pwned (CC BY 4.0)

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Mortal Online is a fantasy game made by Star Vault. It suffered a data breach in June 2018, and Have I Been Pwned (HIBP) lists it as verified. HIBP added it on August 31, 2018.

What happened

A file with around 570,000 email addresses and cracked passwords went around online first. A larger file followed, with about 607,000 email addresses and the original unsalted MD5 password hashes, plus names, usernames and physical addresses. HIBP updated its entry to match the bigger file. The data reached HIBP from security researcher Adam Davies. The studio has a notice about the incident on its own site.

Sources checked: haveibeenpwned.com, account.mortalonline.com

Last verified against the official page: 27 Oct 2026

How we research this Report an error

What was exposed

HIBP lists 606,637 accounts. The data: email addresses, names, passwords, physical addresses and usernames.

The passwords were hashed with MD5 and no salt. A hash is a scrambled version of a password, and unsalted MD5 hashes of common passwords can be reversed fast. The first file already carried cracked passwords. So treat any password you used on a Mortal Online account as known to criminals.

What that lets criminals do

The most direct risk is credential stuffing: trying the same email and password pair on other sites, other games and your email. People reuse passwords. One old game login can open something that matters.

Names and physical addresses make phishing and scam mail more believable. A message that gets your name and street right looks legitimate. Scammers also get a head start on looking you up on people-search sites.

What to do now

Start with email. Change any password that matched your Mortal Online login, then turn on two-factor login. No longer playing? Ask the studio to delete the account.

What to do if you were in it

1

Change your Mortal Online password, and every reuse of it

If you used the same or a similar password anywhere else, change it there too. A password manager makes unique passwords easy.
2

Turn on two-factor login

Use an authenticator app or passkey on your email and other important accounts. It stops most takeovers even when an old password is out there.
3

Expect phishing that fits the data

Email addresses end up on spam and scam lists. Don't click links in messages that mention an account or a breach; go to the site yourself.
4

See which other breaches include you

Run a free Serus scan to see which other breaches include your email or phone.

Timeline

17 Jun 2018
The breach happened
31 Aug 2018
Added to Have I Been Pwned

Frequently asked

Was I affected by the Mortal Online breach?

If you had an account around 2018, check your email on Have I Been Pwned or run a free Serus scan. HIBP lists about 606,637 accounts in this breach.

What was exposed in the Mortal Online breach?

Email addresses, names, passwords stored as unsalted MD5 hashes, physical addresses and usernames.

Should I change my password?

Yes. Change it on every site where you used your Mortal Online password. MD5 hashes like these can be cracked quickly.

Can leaked data be removed from the internet?

No. Breach files circulate beyond anyone's control. You protect yourself with new passwords and two-factor login. Serus monitors breach databases and alerts you when your data shows up.